Committee Reports 2015/16 City of York Council Internal Audit Report

Business Unit: Customer & Business Support Services Responsible Officer: Assistant Director of Governance and ICT Service Manager: Democracy and Member Support Manager Date Issued: 17/03/2016 Status: Final Reference: 10980/002

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Substantial Assurance | Summary and Overall Conclusions

Introduction City of York Council publishes papers for committee meetings on its modgov website. These papers are available to members of the public except where they contain certain information which is exempt from disclosure under the Local Government Act 1972.

In February 2015 an updated draft of the access to information policy was taken to Audit and Governance Committee for comment before being taken to Council for approval to be incorporated into the constitution. This document sets out rights of access to information and includes a list of all of the categories under which exempt information may fall.

The Local Government Association (LGA) peer review published on 17 December 2014 included the finding “Access to salmon papers also seems inconsistent. Generally we feel there may be a culture of over-caution.” An audit was included in the 2015/16 audit plan to review the arrangements around access to and use of private (salmon) papers in committee reports.

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to management that procedures and controls within the system ensure that:

• Information kept confidential from publication is consistent and in line with the council constitution; falling within one of the defined categories of exempt information.

• Access to restricted committee papers by Members is consistent and in line with access to information rights set out in the council constitution.

The audit included a review of a sample of committee papers that have not been made available to the public over the last 12 months. The LGA peer review related to the previous administration and therefore the experiences of returning members was sought during the audit.

Key Findings Only a small number of committee papers are not made available to the public. Of the papers that were restricted over the twelve months reviewed, 65% of them related to planning enforcement cases and HR matters and therefore contained information about specific named individuals. A sample of restricted committee papers was reviewed during the audit. No issues were identified with the process for restricting committee papers. All papers reviewed corresponded to the stated reason for being exempt from published information from the council constitution. The audit identified that there is an up to date procedure in the council’s constitution which sets out Members’ rights of access to information. This highlights the role of the Monitoring Officer in providing support to ensure that decisions are made in line with the constitution. It was found that requests for information can be directed to any relevant Officer and that these should be referred to the Monitoring Officer in cases of doubt. These controls appear to be sufficient to ensure that decisions on the provision of information to Members are taken in line with the council constitution.

However despite this procedure being in place it appears that there may be a perception of inconsistency in how it is applied. In part there is evidence to suggest that although Members have some awareness of their rights to access information there could be improvements in their understanding of the procedure. There is also an inherent risk of a perception of inequality in the existing procedure because information may be requested from a variety of Officers. Whilst in the majority of cases, requesting information from the Officer involved in dealing with the information in question does appear to be the most appropriate process, there may be a benefit in Democratic Services acting as the central point for access to restricted committee papers. This will provide Officers and Members with greater assurance that a consistent approach is being taken.

**Overall Conclusions**

It was found that there are arrangements in place for managing risk however some weaknesses in corporate awareness (from some Members and Officers) were identified that prevented arrangements from being fully effective in all cases. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance. 1 Member access to information

| Issue/Control Weakness | Risk | |------------------------|------| | There is a lack of corporate awareness over the process for members requesting information. | Members may not be given access to information that they are entitled to under the council's access to information protocol. |

Findings

A survey was issued to all members who were re-elected in the May 2015 elections, seeking their views on arrangements for access to information. The responses that were received indicated that although there was a general awareness of the rights to access information there was a lack of familiarity with the procedure in the constitution.

Overall the survey results indicated that respondents did not perceive there to be a clear process in place. A lack of a clear process may result in inconsistencies in how requests for access to information are dealt with which in some cases may lead to the perception of over caution.

Agreed Action 1.1

To work with Members and Officers to refresh and raise awareness of the procedures under the Access to Information Protocol relating to access to exempt information. This can be achieved by features in the Members Newsletters and Buzz, as well as dissemination of information through political assistants and Directorate Management Teams.

It will be highlighted to Members and Officers that requests for confidential committee papers will be dealt with through Democratic Services to ensure a consistent approach is applied.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Democracy and Member Support Manager | 30/06/2016 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.